What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise, up‑to‑date map of the main rules that govern how AI systems are built, deployed, and held accountable as of September 29, 2026. I’ll start with the United States, then give a brief global snapshot.

United States (federal)

•Executive policy for AI changed in 2025–2026. President Trump’s Executive Order 14179 (“Removing Barriers to American Leadership in AI,” Jan. 23, 2025) revoked the prior 2023 AI executive order and directed agencies to pivot toward a pro‑innovation approach; OMB’s Memorandum M‑25‑21 simultaneously rescinded and replaced OMB M‑24‑10, revising federal AI governance, risk‑management, and procurement rules.[1]

•Voluntary federal risk guidance: NIST’s AI Risk Management Framework (AI RMF 1.0) remains the leading nonbinding baseline for building and operating “trustworthy AI,” with a 2024 profile for generative AI. Agencies and many private firms reference it in policy and audits.[2]

•Sector‑specific oversight (existing laws applied to AI):

•FTC enforces unfair/deceptive practices (e.g., exaggerated “AI” claims; discriminatory outcomes) under the FTC Act and related laws; the agency has warned that there is “no AI exemption” from the rules.[3]

•CFPB requires specific, accurate adverse‑action reasons even when creditors use complex or “black‑box” models (ECOA/Reg B).[4]

•FDA now accepts “predetermined change control plans” (PCCPs) for AI‑enabled medical devices so approved models can be updated safely without a full re‑submission each time.[5]

•DOT/NHTSA guidance on Automated Driving Systems remains largely voluntary (ADS 2.0/AV 3.0), but influences testing, safety self‑assessments, and disclosures.[6]

United States (state and local)

•Colorado AI Act (SB24‑205): first broad state AI statute. Effective February 1, 2026, it imposes “reasonable care” duties on developers and deployers of “high‑risk” AI (employment, education, financial services, housing, health care, insurance, legal, government services), requires impact/risk assessments and consumer notices, and makes violations enforceable under the state’s consumer‑protection law.[7]

•California CPPA regulations on Automated Decision‑Making Technology (ADMT): final rules effective January 1, 2026, require pre‑use notices, access and opt‑out rights, and risk assessments for defined “significant decisions”; compliance for significant‑decision uses must begin no later than January 1, 2027.[8]

•New York City’s Local Law 144 (automated employment decision tools): since July 2023, employers using covered tools in NYC hiring/promotion must post independent annual bias‑audit summaries and give candidate notices.[9]

European Union

•EU AI Act: a comprehensive, risk‑based regime with phased application dates. Key milestones now set by the 2026 “AI Omnibus” adjustments include: transparency duties from August 2, 2026; Annex III “high‑risk” system obligations from December 2, 2027; and high‑risk AI embedded in regulated products from August 2, 2028. Prohibited practices and certain governance/GPAI provisions apply earlier per the Act’s staged schedule.[10]

•Digital Services Act (DSA): very large online platforms/search engines (VLOPs/VLOSEs) must perform systemic risk assessments, adapt recommender systems, and increase transparency—rules that capture many algorithmic deployments at scale.[11]

•Product liability/safety: the updated Product Liability Directive now expressly covers software and AI systems; the new Machinery Regulation applies from January 20, 2027, with safety duties relevant to AI‑enabled machinery.[12]

United Kingdom

•The UK uses a “pro‑innovation,” regulator‑led approach (no cross‑cutting AI statute). Government issued non‑statutory principles and guidance for regulators; the AI Safety Institute develops testing/evaluation methods; and the CMA has set competition/consumer‑protection principles for foundation models.[13]

Canada

•The federal Artificial Intelligence and Data Act (AIDA), proposed in Bill C‑27, did not become law; the government continues to pursue targeted instruments and voluntary measures (e.g., a voluntary code for advanced generative AI) while developing further policy.[14]

China

•Algorithmic governance relies on binding, service‑level rules: Algorithmic Recommendation Provisions (effective March 1, 2022), Deep Synthesis Provisions (effective January 10, 2023), and Interim Measures for Generative AI Services (effective August 15, 2023) impose filing, labeling, security, and content‑governance duties on providers.[15]

International instruments and standards (often used in contracts, audits, and procurement)

•Council of Europe Framework Convention on AI (CETS No. 225): the first binding international AI treaty, opened for signature September 5, 2024; it requires Parties to ensure AI lifecycle activities align with human rights, democracy, and rule of law.[16]

•OECD AI Principles (2019; updated 2024): widely referenced, nonbinding principles on trustworthy AI, interoperability, and policy toolkits.[17]

•Management and risk standards commonly written into contracts and assurance programs:

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management).[18]

•NIST AI RMF 1.0 (and Generative AI Profile).[19]

•IEEE 7000‑2021 (ethical concerns during system design), often cited for “ethics by design” processes.[20]

What this means in practice

•In the U.S., there’s no single AI law. Accountability typically comes from sectoral regulators (FTC, CFPB, FDA, NHTSA), general consumer‑protection and civil‑rights laws, federal procurement rules, and a growing layer of state/local AI and privacy regulations (e.g., Colorado, California, NYC).

•If you build or deploy AI for the EU market, the AI Act’s timelines and conformity‑assessment regime will likely be the most prescriptive set of obligations in the world, with DSA duties layered on top for large platforms.

•Many organizations operationalize “rules of the road” through standards frameworks (NIST AI RMF, ISO/IEC 42001/23894) even where not legally required, because they’re increasingly expected by customers, auditors, and regulators.

If you tell me your sector, deployment locale(s), and whether you’re a developer, deployer, or customer, I can map the exact requirements and deadlines you face and suggest a minimal compliance plan.

Citations (20)

1whitehouse.govGovernment
Removing Barriers to American Leadership in Artificial Intelligence – The White House
Backs: “OMB’s Memorandum M‑25‑21 simultaneously rescinded and replaced OMB M‑24‑10, revising federal AI governance, risk‑management, and procurement rules.”
2nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “Agencies and many private firms reference it in policy and audits.”
3ftc.govGovernment
Statement of Chair Lina M. Khan Regarding the Joint Interagency Statement on AI
Backs: “FTC enforces unfair/deceptive practices (e.g., exaggerated “AI” claims; discriminatory outcomes) under the FTC Act and related laws; the agency has warned that there is “no AI exemption” from the rules.”
4consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB requires specific, accurate adverse‑action reasons even when creditors use complex or “black‑box” models (ECOA/Reg B).”
5fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “FDA now accepts “predetermined change control plans” (PCCPs) for AI‑enabled medical devices so approved models can be updated safely without a full re‑submission each time.”
6nhtsa.govGovernment
Automated Driving Systems | NHTSA
Backs: “DOT/NHTSA guidance on Automated Driving Systems remains largely voluntary (ADS 2.0/AV 3.0), but influences testing, safety self‑assessments, and disclosures.”
7colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Effective February 1, 2026, it imposes “reasonable care” duties on developers and deployers of “high‑risk” AI (employment, education, financial services, housing, health care, insurance, legal, government services), requires impact/risk assessments and consumer notices, and makes violations enforceable under the…”
8ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations on Automated Decision‑Making Technology (ADMT): final rules effective January 1, 2026, require pre‑use notices, access and opt‑out rights, and risk assessments for defined “significant decisions”; compliance for significant‑decision uses must begin no later than January 1, 2027.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City’s Local Law 144 (automated employment decision tools): since July 2023, employers using covered tools in NYC hiring/promotion must post independent annual bias‑audit summaries and give candidate notices.”
10europa.euGovernment
AI Omnibus enters into force | Shaping Europe’s digital future
Backs: “Prohibited practices and certain governance/GPAI provisions apply earlier per the Act’s staged schedule.”
11europa.euGovernment
DSA: Very large online platforms and search engines | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): very large online platforms/search engines (VLOPs/VLOSEs) must perform systemic risk assessments, adapt recommender systems, and increase transparency—rules that capture many algorithmic deployments at scale.”
12europa.euGovernment
Defective products – liability | EUR-Lex
Backs: “Product liability/safety: the updated Product Liability Directive now expressly covers software and AI systems; the new Machinery Regulation applies from January 20, 2027, with safety duties relevant to AI‑enabled machinery.”
13gov.ukGovernment
A pro-innovation approach to AI regulation - GOV.UK
Backs: “Government issued non‑statutory principles and guidance for regulators; the AI Safety Institute develops testing/evaluation methods; and the CMA has set competition/consumer‑protection principles for foundation models.”
14parl.caNot yet classified
C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “The federal Artificial Intelligence and Data Act (AIDA), proposed in Bill C‑27, did not become law; the government continues to pursue targeted instruments and voluntary measures (e.g., a voluntary code for advanced generative AI) while developing further policy.”
15cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “Algorithmic Recommendation Provisions (effective March 1, 2022), Deep Synthesis Provisions (effective January 10, 2023), and Interim Measures for Generative AI Services (effective August 15, 2023) impose filing, labeling, security, and content‑governance duties on providers.”
16coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “225): the first binding international AI treaty, opened for signature September 5, 2024; it requires Parties to ensure AI lifecycle activities align with human rights, democracy, and rule of law.”
17oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (2019; updated 2024): widely referenced, nonbinding principles on trustworthy AI, interoperability, and policy toolkits.”
18iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management).”
19nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI RMF 1.0 (and Generative AI Profile).”
20ieee.orgNot yet classified
7000-2021 - IEEE Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standard | IEEE Xplore
Backs: “IEEE 7000‑2021 (ethical concerns during system design), often cited for “ethics by design” processes.”